Ride the Lightning

THE EVIL INTERNET DEFENSE: FOR REAL THIS TIME?

June 20, 2008

The “evil Internet” defense is the bane of computer forensics. Normally, we hear this argument from those who are charged with child pornography – inevitably, they profess their innocence and their normal ludicrous argument is that a virus, worm or Trojan must have caused the pornography to appear on their computers. As you might imagine, it is generally quite provable that they were: 1) searching for child porn and/or 2) that a human being actually created folders into which the porn was deposited. Others things can be proved as well, but those are the most common. Usually, the evidence we find is used as a baseball bat by the defense attorney, who figuratively beats the client over the head while advising the client to “take the plea.”

But . . . rather to our amazement . . . we have finally found not one but two cases where the “evil Internet” may actually have been responsible for the downloading of child pornography unbeknownst to the user. The first case involved Department of Industrial Accidents investigator Michael Fiola, who was fired from his job for allegedly downloading child pornography on his work laptop. He was later prosecuted. His computer forensics expert opined that his laptop was running corrupted virus protection software, and that the machine was assaulted by spammers and hackers who bombarded its memory with images of incest and child porn not visible to the user. All of the images were located in the laptop’s Internet cache. Normally, we might raise an eyebrow and look askance, but two separate forensic examinations conducted by the Massachusetts Attorney General’s Office concurred with the findings. When the prosecution and defense experts agree, the result is usually correct – it sure doesn’t happen very often.

Further information about the Fiola case may be found at http://www.bostonherald.com/business/technology/general/view.bg?&articleid=1101074&format=&page=1&listingType=tec#articleFull

The second case involved 16-year-old Matt Bandy, who faced charges of possessing child porn on the family computer. His expert found that there were more than 200 viruses on the hard drive, the anti-virus software had been disabled, there was no firewall, a number of the viruses could allow someone to remotely control the computer, there was never a way to tell who was on the computer because there was only one login, one of the viruses even renamed hundreds of files, making it difficult to track activity and there were a number of suspicious executable programs that started running during the time period when the child pornography images were allegedly transmitted. The family took and passed polygraph exams with flying colors. They also went through psychosexual assessments and passed with flying colors. With all the evidence, the prosecution finally agreed to reduce the charges but not to drop them. Faced with the uncertainty of a jury trial, and based on legal counsel, Matt finally pled guilty to three lesser offenses and received 18 months probation with sex offender terms attached, the latter finally dismissed by the court.

Once again, there was at least a credible showing of evidence which might have exonerated Matt. Matt’s story may be found at http://www.justice4matt.com/MattsStory.html.

Now, having read the available defense forensics reports in both cases, my technologists have shaken their heads – there were some errors and omissions in both reports according to them. And more that they thought should have been done. Finally, we were all bemused to see that the forensic expert had the child porn evidence in her possession in contravention of the Adam Walsh Act. She had a court order, but we we all know, the feds have said that there is no court order that protects the forensic expert from the Act – and they have made at least one arrest of a computer forensic expert for child porn possession.

My technologists say they would need to evaluate the evidence from scratch to see if the “Evil Internet” defense holds water in these two cases. But, strikingly, these are the first two cases my guys have seen where (based on the published facts) they were really willing to consider the possibility that the “Evil Internet” defense might be valid. Their fingers were itching to have the evidence accessible through their keyboards. Sorry boys – maybe next time.

Hat tip to Jesse Lindmar for sending these along.

E-mail:     Phone:          703-359-0700